Hazard mitigation in medical device

ABSTRACT

Delivery of energy by a defibrillator or other medical device is inhibited when the processor or software that controls a module of the medical device operates abnormally. A windowed watchdog timer (WWDT) incorporated into one module of the medical device is used to control the operation of other modules of the medical device via a software-based extension technique. As a result, the risk of harm to the patient is reduced compared to medical devices that incorporate over-limit type watchdog timers. In addition, costs associated with implementing WWDTs in multiple modules of the defibrillator are avoided, thereby lowering the overall cost of implementation.

TECHNICAL FIELD

The invention relates generally to medical devices and, morespecifically, to safety features in such devices.

BACKGROUND

Ventricular fibrillation and atrial fibrillation are common anddangerous medical conditions that cause the electrical activity of thehuman heart to become unsynchronized. Loss of synchronization may impairthe natural ability of the heart to contract and pump blood throughoutthe body. Medical personnel treat fibrillation by using a defibrillatorsystem to apply a relatively large electrical charge to the heart viadefibrillator electrodes. If successful, the charge overcomes theunsynchronized electrical activity and gives the natural pacing functionof the heart an opportunity to recapture the heart and reestablish anormal sinus rhythm.

Some defibrillator systems incorporate a number of functional modules.These modules may include, for example, a therapy module that controlsthe defibrillator electrodes, a user interface module that receivesinput and presents output to medical personnel, and a patient parametersmodule that obtains information from the patient. Each module typicallyincorporates an embedded microprocessor that executes software forcontrolling the operation of the module.

Abnormal operation of the embedded microprocessor or software thatcontrols a module can be hazardous to the patient. For example, amalfunction in the user interface module may cause the defibrillator todeliver electrical shocks to the patient when no therapy was requestedby an operator. Inappropriately delivered shocks can be painful orharmful to the patient.

To reduce the risk of abnormal processor or software operation, somedefibrillators incorporate a conventional watchdog timer that resets theprocessor in a module if the processor functions abnormally. Thewatchdog timer requires a handshake from the processor at a prescribedtime to validate proper operation of the processor. The processorcontains a watchdog timer process manager that verifies that theexpected processes have performed normally by examining whether theprocesses have properly “checked in” during a particular time intervaland, if so, outputs a handshake signal to the watchdog timer. If thewatchdog timer does not detect the handshake signal within theprescribed time, the watchdog timer places the processor in a resetstate to reinitialize the processor to a known safe state and inhibitsthe therapy module from inadvertently delivering an electrical shock tothe patient via the defibrillator electrodes.

The watchdog timer is typically implemented as an over-limit watchdogtimer that resets the processor after a maximum prescribed time haselapsed without a handshake from the watchdog timer process manager.While this approach improves the reliability of the defibrillator, somesafety guidelines require an additional degree of hazard mitigation. Forexample, the Technischer Überwachungsverein (TUV) (Technical InspectionAssociation) safety guidelines require the use of a windowed watchdogtimer (WWDT) that resets the processor not only after a maximum elapsedtime without a handshake, but also after receiving a handshake before aminimum elapsed time.

SUMMARY

In general, the invention promotes safe operation of defibrillators andother medical devices that deliver energy to a patient by inhibitingenergy delivery when the processor or software that controls a moduleoperates abnormally. In some implementations, a windowed watchdog timer(WWDT) incorporated into one module of a defibrillator is used incontrolling the operation of other modules of the defibrillator. Asoftware-based “extension” technique may be used to leverage a singleWWDT across multiple embedded processors, thereby avoiding the need toincorporate a dedicated WWDT in each embedded processor.

The invention may offer several advantages. For instance, the use of aWWDT to control defibrillator operation offers a greater degree ofhazard mitigation than is offered by over-limit type watchdog timers. Inaddition, by using a single WWDT to inhibit defibrillator operation,costs associated with implementing WWDTs in multiple modules of thedefibrillator are avoided, thereby lowering the overall cost ofimplementation.

One embodiment is directed to a method for leveraging a WWDT acrossmultiple modules of a medical device. A handshake signal is generated ina first processor of a medical device and provided to a second processorof the medical device. The second processor resets the first processorwhen the handshake signal is not provided within a prescribed timeinterval.

Other implementations include medical devices that carry out thesemethods, as well as processor-readable media containing instructionsthat cause a processor within a defibrillator to perform these methods.For example, in one embodiment, a medical device includes a firstfunctional module having a first embedded processor that generates awatchdog signal. A second functional module has a second embeddedprocessor that receives the watchdog signal and resets when the watchdogsignal is not provided within a prescribed time interval.

The details of one or more embodiments of the invention are set forth inthe accompanying drawings and the description below. Other features,objects, and advantages of the invention will be apparent from thedescription and drawings, and from the claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram illustrating a medical device configuredaccording to an embodiment of the invention.

FIG. 2 is a block diagram illustrating an example implementation of amedical device.

FIG. 3 is a block diagram illustrating an example implementation of atherapy control module.

DETAILED DESCRIPTION

FIG. 1 is a block diagram illustrating a medical device system in whichthe invention may be practiced. When activated by an operator 10, amedical device 12 administers a therapy regimen to a patient 16. Medicaldevice 12 may be implemented, for example, as an automated externaldefibrillator (AED) or manual defibrillator that applies electric shocksto patient 16. It will be appreciated by those skilled in the art thatmedical device 12 may deliver other forms of therapy.

Operation of medical device 12 is controlled by a system controller 18that is connected to a system bus 20. System controller 18 may beimplemented as a microprocessor that communicates control and datasignals with other components of medical device 12 via system bus 20.These components may include functional modules, such as therapy controlmodule 14 or other therapy modules, a patient parameters module 22, anda user interface module 24.

Therapy control module 14 causes therapy to be delivered to patient 16.For example, if medical device 12 is an AED, therapy control module 14causes defibrillator electrodes to deliver electric shocks to patient 16in response to control signals received from system controller 18 viasystem bus 20. Therapy control module 14 may include, for example,charging circuitry, a battery, and a discharge circuit. Any or all ofthese components can be controlled by system controller 18.

Patient parameters module 22 collects information from patient 16,including, for example, vital signs, non-invasive blood pressure (NIBP)measurements, and saturation of oxyhemoglobin (SpO₂) information. Otherinformation relating to patient 16 may be collected by patientparameters module 22, including, but not limited to, EEG measurements,invasive blood pressure measurements, temperature measurements, and endtidal CO₂ (ETCO₂) information.

User interface module 24 receives input from operator 10 and outputsinformation to operator 10 using any of a variety of input and outputdevices. For example, operator 10 may use keys to input commands tomedical device 12 and receive prompts or other information via a displayscreen or LED indicators. As an alternative, the display screen may beimplemented as a touch-screen display for both input and output. Inaddition, user interface module 24 may print text reports or waveformsusing a strip chart recorder or similar device. User interface module 24may also interface with a rotary encoder device.

User interface module 24 provides input received from operator 10 to anoperating system 26 that controls operation of medical device 12 viasystem controller 18. Operating system 26 may be implemented as a set ofprocessor-readable instructions that are executed by system controller18. When medical device 12 is activated, operating system 26 causestherapy control module 14 to deliver therapeutic shocks to patient 16via defibrillator electrodes, for example, according to an energyprotocol.

As described above, system controller 18, therapy control module 14,patient parameters module 22, and user interface module 24 are connectedto each other via system bus 20. System bus 20 may be implemented usingany of a number of bus architectures. For example, while not required,system bus 20 may be implemented as a USB-compatible system bus asdescribed in pending U.S. patent application Ser. No. 09/922708, filedon Nov. 19, 2001 and hereby incorporated by reference in its entirety.

Each of therapy control module 14, system controller 18, patientparameters module 22, and user interface module 24 may incorporate aprocessor to govern its operations. Moreover, the operation of therapycontrol module 14, system controller 18, patient parameters module 22,and user interface module 24 may be governed by watchdog timers. Eachwatchdog timer requires a handshake at a prescribed time to validateproper operation of the processor of its associated module. Theprocessors contain watchdog timer process managers that verify that theexpected processes have performed normally by examining whether theprocesses have properly “checked in” during a particular time interval.If the processes have properly checked in during the prescribed timeinterval, a confirmation or handshake signal is output to the watchdogtimer. If the watchdog timer does not detect the handshake signal withinthe prescribed time, the watchdog timer places the processor in a resetstate to reinitialize the processor to a known safe state. In addition,the watchdog timer may inhibit therapy control module 14 frominadvertently delivering an electrical shock to the patient viadefibrillator electrodes.

According to various embodiments of the invention, one or more oftherapy control module 14, system controller 18, patient parametersmodule 22, and user interface module 24 may incorporate a windowedwatchdog timer that is leveraged across several modules to control themodules. For example, as described below in connection with FIG. 2,therapy control module 14 may incorporate a windowed watchdog timer(WWDT) that is used to control the operation of system controller 18,patient parameters module 22, and user interface module 24.

FIG. 2 is a block diagram illustrating an example implementation ofmedical device 12. As depicted in FIG. 2, therapy control module 14,system controller 18, patient parameters module 22, and user interfacemodule 24 exchange watchdog timer and reset signals with each other,e.g., via system bus 20 of FIG. 1. Paths communicating watchdog timersignals, such as handshake signals, are illustrated by solid lines,while paths communicating reset or disable signals are illustrated bybroken lines.

One or more of therapy control module 14, system controller 18, patientparameters module 22, and user interface module 24 may incorporate anembedded processor. Each embedded processor incorporates watchdog timer(WDT) hardware 30 that resets the processor after a maximum elapsed timewithout a handshake. The embedded processor in one module, such astherapy control module 14, incorporates WWDT hardware 32 that resets aprocessor not only after a maximum elapsed time without a handshake, butalso after receiving a handshake before a minimum elapsed time. WhileWWDT hardware 32 may be incorporated in any module, incorporating WWDThardware 32 in therapy control module 14 may offer the benefit ofimproved safety when therapy control module 14 controls output hardware34 that can harm patient 16 if activated inappropriately. As aparticular example, incorporating WWDT hardware 32 in therapy controlmodule 14 may be especially beneficial when output hardware 34 delivershigh power defibrillation shocks.

The embedded processor in therapy control module 14 executes a number oftherapy processes 36A, 36B, collectively referred to as therapyprocesses 36. Therapy processes 36 may include software processes thatcontrol various operational aspects of output hardware 34. For example,therapy control processes 36 may include processes that select energydosage schedules. In some types of medical devices, therapy controlprocesses 36 may include processes that control external pacing. Therapycontrol processes 36 may include more or fewer processes than are shownin FIG. 2.

As therapy processes 36 execute, therapy control module 14 increments asequence counter 38 that counts the number of modules that check in. Theembedded processor also executes a watchdog process manager 40 thatperiodically clears sequence counter 38 and issues a handshake signal toWWDT hardware 32 when the count is correct.

If a therapy process 36 executes abnormally, however, either watchdogprocess manager 40 is not executed or the module count is incorrect. Ifthe module count is incorrect, a handshake signal is not issued. As aresult, WWDT hardware 32 does not receive the handshake signal fromwatchdog process manager 40 within the prescribed time. WWDT hardware 32then asserts the embedded processor reset signal in therapy controlmodule 14. WWDT hardware 32 may also disable output hardware 34 as anadded safety measure.

WWDT hardware 32 also resets the embedded processor and disables outputhardware 34 if WWDT hardware 32 receives the handshake signal fromwatchdog process manager 40 too early, e.g., before a specified minimumcount is reached. Abnormal processor operation may be indicated when ahandshake signal is received either too early or too late. Thus,resetting the processor and disabling output hardware 34 when ahandshake signal is received too early provides an additional safeguardagainst abnormal operation and, as a result, an added degree of hazardmitigation.

According to various embodiments of the invention, the safety benefitsimparted by WWDT hardware 32 are leveraged across one or more embeddedprocessors in other modules via a software-based extension technique. Inparticular, WWDT software 42 may receive handshakes from other modulesthat may or may not include watchdog timer (WDT) hardware via ahandshake link. The handshake link can be implemented as a discretesignal or a message communicated via a serial or parallel bus interfaceand may include, for example, an intermodule communication module 44that communicates with other modules using either a wired or a wirelesslink. Intermodule communication module 44 may communicate hardware resetsignals with the other modules, as shown in FIG. 2, and may alsocommunicate handshake signals.

As a particular example, therapy control module 14 may communicate viaintercommunication module 44 with a communication interface 46 in systemcontroller 18. An embedded processor in system controller 18 may executea number of system control processes 48A, 48B, collectively referred toas system control processes 48. These processes may include, forexample, updating displays or responding to a request to providetherapy. System control processes 48 may include more or fewer processesthan are shown in FIG. 2.

As system control processes 48 execute, system control processes 48check in with a task check-in module 50. The embedded processor insystem controller 18 also executes a watchdog process manager 52 thatperiodically resets task check-in module 50 and issues handshake signalsto WDT hardware 30 and to WWDT software 42 executing in therapy controlmodule 14. As long as system control processes 48 continue to executeproperly, task check-in module 50 is cleared.

If a system control process 48 executes abnormally, however, eitherwatchdog process manager 52 is not executed or the task check-in is notcleared. If the task check-in is not cleared, a handshake signal is notissued. As a result, WDT hardware 30 and WWDT software 42 do not receivethe handshake signal from watchdog process manager 52. WDT hardware 30resets the embedded processor in system controller 18. In addition, WWDTsoftware 42 resets therapy control module 14 if the handshake signal isreceived either too early or too late from watchdog process manager 52.WWDT software 42 thereby verifies the proper operation not only oftherapy control module 14, but also of system controller 18. In thismanner, the hazard mitigation benefits of a windowed watchdog timer maybe realized in system controller 18 without incorporating ahardware-based windowed watchdog timer in system controller 18.

System controller 18 may in turn leverage the benefits of WWDT hardware32 to patient parameters module 22 and user interface module 24 via WWDTsoftware processes 54 and 56, respectively. For example, systemcontroller 18 may communicate reset signals with patient parametersmodule 22 via a hardware interface 58 and communication interfacehardware 60 in patient parameters module 22.

The embedded processor in patient parameters module 22 executes a numberof patient parameters processes 62A, 62B, collectively referred to aspatient parameters processes 62. Patient parameters processes 62 mayinclude software processes that control various operational aspects ofpatient parameters module 22. For example, patient parameters processes62 may include processes for collecting various types of informationfrom patient 16, such as vital signs, non-invasive blood pressure (NIBP)measurements, and SpO₂ information. Patient parameters processes 62 mayalso include processes for collecting EEG measurements, invasive bloodpressure measurements, temperature measurements, and ETCO₂ information.The embedded processor in patient parameters module 22 may execute moreor fewer patient parameters processes 62 than are shown in FIG. 2.

As patient parameters processes 62 execute, patient parameters processes62 increment a sequence counter 64 that counts the number of modulesthat check in. The embedded processor also executes a watchdog processmanager 66 that periodically clears sequence counter 64 and issues ahandshake signal to WWDT software 54 when the count is correct.

If a patient parameters process 62 executes abnormally, however, eitherwatchdog process manager 66 is not executed or the module count isincorrect. If the module count is incorrect, a handshake signal is notissued. As a result, WWDT software 54 does not receive the handshakesignal from watchdog process manager 66 within the prescribed time. Inaddition, sequence counter 64 continues to increment until the timeoutcount is reached. WWDT software 54 then asserts the embedded processorreset signal in patient parameters module 22, which may also be reset byWDT hardware 30. Communication interface hardware 60 may also transmit areset signal to communication interface 46 in the embedded processor insystem controller 18, thereby causing system controller 18 to reset.Communication interface 46 may in turn communicate a reset signal tointermodule communication module 44, causing therapy control module 14to reset and disabling output hardware 34.

Similarly, system controller 18 may communicate reset signals with userinterface module 24 via a hardware interface 68 and communicationinterface hardware 70 in user interface module 24. The embeddedprocessor in user interface module 24 executes a number of patientparameters processes 72A, 72B, collectively referred to as userinterface processes 72. User interface processes 72 may include softwareprocesses that control various operational aspects of user interfacemodule 24. For example, user interface processes 72 may includeprocesses for receiving input from operator 10 and presentinginformation to operator 10 using any of a variety of input and outputdevices, including but not limited to keys, a touch screen, a displayscreen, or LED indicators. In addition, user interface processes 72 mayinclude processes for printing text reports or waveforms using a stripchart recorder or similar device. The embedded processor in userinterface module 24 may execute more or fewer user interface processes72 than are shown in FIG. 2.

As user interface processes 72 execute, user interface processes 72increment a sequence counter 74 that counts the number of modules thatcheck in. The embedded processor also executes a watchdog processmanager 76 that periodically clears sequence counter 74 and issues ahandshake signal to WWDT software 56 when the count is correct.

If a user interface process 72 executes abnormally, however, eitherwatchdog process manager 76 is not executed or the module count isincorrect. If the module count is incorrect, a handshake signal is notissued. As a result, WWDT software 56 does not receive the handshakesignal from watchdog process manager 76 within the prescribed time. WWDTsoftware 56 then asserts the embedded processor reset signal in userinterface module 24, which may also be reset by WDT hardware 30. Whilenot required, communication interface hardware 70 may also transmit areset signal to communication interface 46 in the embedded processor insystem controller 18, thereby causing system controller 18 to reset.Communication interface 46 may in turn communicate a reset signal tointermodule communication module 44, causing therapy control module 14to reset and disabling output hardware 34.

Leveraging WWDT hardware 32 across multiple embedded processors via WWDTsoftware 42, 54, 56 enables multiple modules within medical device 12 torealize the enhanced safety benefits of a windowed watchdog timerwithout incorporating a hardware-based windowed watchdog timer in eachembedded processor. Hardware complexity and cost may be reduced as aresult.

The configuration depicted in FIG. 2 is illustrative of variousembodiments of the invention. For example, FIG. 2 depicts the embeddedprocessor in system controller 18 cascaded serially from WWDT hardware32 by WWDT software 42. The embedded processors in patient parametersmodule 22 and user interface module 24 are illustrated as cascaded inparallel from the embedded processor in system controller via WWDTsoftware 54, 56. Other configurations, however, may be implementedconsistent with the principles of the invention. For instance, theembedded processors in patient parameters module 22 and user interfacemodule 24 may be cascaded serially from the embedded processor in systemcontroller 18. As another example, the embedded processors in systemcontroller 18, patient parameters module 22, and user interface module24 can all be cascaded in parallel from WWDT hardware 32. Moregenerally, other combinations of serial- and parallel-cascaded embeddedprocessors can be implemented consistent with the principles of theinvention.

The WWDT software may be implemented as a set of computer-executableinstructions stored in some form of computer readable media. Computerreadable media can be any available media that can be accessed bymedical device 12. By way of example, and not limitation, computerreadable media may comprise computer storage media and communicationmedia. Computer storage media includes volatile and nonvolatile,removable and nonremovable media implemented in any method or technologyfor storage of information, such as computer readable instructions, datastructures, program modules, or other data. Computer storage mediaincludes, but is not limited to, random access memory (RAM), read onlymemory (ROM), EEPROM, flash memory or other memory technology, CD-ROM,digital versatile discs (DVD) or other optical storage, magneticcassettes, magnetic tape, magnetic disk storage or other magneticstorage devices, or any other medium that can be used to store thedesired information and that can be accessed by medical device 12.Communication media typically embodies computer readable instructions,data structures, program modules, or other data in a modulated datasignal such as a carrier wave or other transport mechanism and includesany information delivery media. The term “modulated data signal” means asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media includes wired media, such as awired network or other direct-wired connection, and wireless media, suchas acoustic, RF, infrared, and other wireless media. Combinations of anyof the above computer storage media and communication media are alsoincluded within the scope of computer-readable media.

FIG. 3 is a block diagram illustrating an example embodiment of therapycontrol module 14. The hardware configuration shown in FIG. 3 implementsthe WWDT functionality described above in connection with FIG. 2 andimplements an additional measure of hazard mitigation by using aregulated voltage monitor to inhibit an abnormally operating processorfrom activating output hardware 34.

As depicted in FIG. 3, an embedded processor 100 controls an energyshaping circuit 102 via NW, NE, SW, and SE drive lines and an isolationrelay 104 via an isolation relay drive line. While not shown in FIG. 3,isolation relay 104 may be incorporated as part of energy shapingcircuit 102. To deliver a defibrillation shock, embedded processor 100first charges a capacitor 106 using a capacitor charger 108, thenactivates isolation relay 104 and energy shaping circuit 102 to deliverthe shock to patient 16. A similar process may be used to deliver apacing pulse to patient 16. As shown in FIG. 3, for example, embeddedprocessor 100 may control a pacing current drive circuit 120.

When capacitor 106 is charged to a non-zero voltage, loss of power orabnormal operation of embedded processor 100 may cause the drive linesof embedded processor 100 to change state. Isolation relay 104 andenergy shaping circuit 102 may be inadvertently activated as a result,thereby delivering a shock to patient 16.

To reduce the risk of inappropriate delivery of a shock to patient 16, avoltage monitor 110 monitors an output V_(LOGIC) of a voltage regulator112. If voltage monitor 110 detects a loss of power or any unexpectedvoltage, voltage monitor 110 generates a reset signal. A reset signal isalso generated by WWDT hardware 32 if WWDT hardware 32 receives an earlyor late watchdog signal from embedded processor 100 on a line 114.

When either voltage monitor 110 or WWDT hardware 32 generates a resetsignal, embedded processor 100 is reset and isolation relay 104 isprevented being driven to the “on” state. The reset signals generated byvoltage monitor 110 and WWDT hardware 32 may be provided to an OR gate,as shown in FIG. 3, such that either reset signal will reset embeddedprocessor 100 and inhibit isolation relay 104. A diode 118 prevents thereset outputs of voltage monitor 110 and WWDT hardware 32 frominadvertently activating isolation relay drive transistor 116.

Various embodiments of the invention have been described. The inventionmay be used in AEDs as well as other types of defibrillators. Inaddition, while several embodiments of the invention have been describedin the context of a defibrillator, the principles of the invention maybe practiced in other types of medical devices, including, but notlimited to, defibrillator/pacemakers and therapy devices for othermedical conditions, such as stroke and respiratory conditions. These andother embodiments are within the scope of the following claims.

1. An external defibrillator comprising: a therapy control module tocontrol delivery of defibrillation shocks to a patient, the therapycontrol module including a first processor that generates a firsthandshake signal and a watchdog timer hardware unit that resets thefirst processor when the first handshake signal is not generated withina first time interval specified by the watchdog timer hardware unit; anda system control module including a second processor to generate asecond handshake signal, wherein the therapy control module includes awatchdog timer software process on the first processor to reset thefirst processor when the second handshake signal is not generated withinthe first time interval.
 2. The external defibrillator of claim 1,wherein the watchdog timer hardware unit resets the first processor whenthe handshake signal is provided before a minimum time or after amaximum time.
 3. The external defibrillator of claim 1, furthercomprising means for disabling therapy output hardware when the firsthandshake signal is not provided within the first time interval.
 4. Theexternal defibrillator of claim 1, further comprising a voltage monitorfor detecting an abnormal power condition and disabling therapy outputhardware in response to the abnormal power condition.
 5. The externaldefibrillator of claim 1, further comprising a voltage monitor fordetecting a voltage of the medical device.
 6. The external defibrillatorof claim 5, further comprising means for selectively disabling therapyoutput hardware as a function of the detected voltage.
 7. The externaldefibrillator of claim 1, further comprising at least one of a userinterface module and a patient parameters module.
 8. The externaldefibrillator of claim 7, wherein the user interface module iscommunicatively coupled to at least one of a keyboard, a display screen,and a strip chart recorder.
 9. The external defibrillator of claim 7,wherein the patient parameters module is configured to obtain at leastone of ECG information, vital sign measurements, non-invasive bloodpressure (NIBP) measurements, and SpO₂ information from a patient. 10.The external defibrillator of claim 1, wherein the externaldefibrillator is an automated external defibrillator.
 11. The externaldefibrillator of claim 1, further comprising a functional moduleincluding a third processor configured to generate a third handshakesignal, wherein the system control module processor includes anotherwatchdog timer software process to receive the third handshake signaland to reset the third processor when the third handshake signal is notprovided within a prescribed time interval.
 12. The defibrillator ofclaim 1, wherein the system control module includes a second watchdogtimer hardware unit to reset the second processor when the secondhandshake signal is not generated within a second time interval.
 13. Thedefibrillator of claim 1, wherein the first watchdog timer hardware unitis a windowed watchdog timer hardware unit.
 14. The defibrillator ofclaim 1, further comprising: a user interface module to control inputand output of information for an operator, the user interface moduleincluding a third processor that generates a third handshake signal,wherein the system control module includes a second watchdog timersoftware process corresponding to the second watchdog timer hardwareunit, the second watchdog timer software process resetting the thirdprocessor when the third handshake signal is not generated within thesecond time interval.
 15. The defibrillator of claim 1, furthercomprising: a patient parameters module to process one or morephysiological parameters of the patient, the patient parameters moduleincluding a third processor that generates a third handshake signal,wherein the system control module includes a second watchdog timersoftware process corresponding to the second watchdog timer hardwareunit, the second watchdog timer software process resetting the thirdprocessor when the third handshake signal is not generated within thesecond time interval.
 16. The defibrillator of claim 1, furthercomprising: a user interface module to control input and output ofinformation for an operator, the user interface module including a thirdprocessor that generates a third handshake signal, wherein the systemcontrol module includes a second watchdog timer software processcorresponding to the first watchdog timer hardware unit, the secondwatchdog timer software process resetting the third processor when thethird handshake signal is not generated within the first time interval.17. The defibrillator of claim 1, further comprising: a patientparameters module to process one or more physiological parameters of thepatient, the patient parameters module including a third processor thatgenerates a third handshake signal, wherein the system control moduleincludes a second watchdog timer software process corresponding to thefirst watchdog timer hardware unit, the second watchdog timer softwareprocess resetting the third processor when the third handshake signal isnot generated within the first time interval.